What is required:

1) Needs to talk SPNEGO on the backend (http://en.wikipedia.org/wiki/SPNEGO)
a) should have standard timeout behavior (I don't know if this is handled automatically or not, but I'd want it to match standard behavior) - as in caching credentials/tickets so every request is not being passed to the authentication mechanism
b) authenticates against Active Directory (ideally OpenLDAP and A/D)

2) Browser support - needs to be promptless Windows Integrated Behavior behavior
a) required: IE6, IE7, Firefox 2.X ??
b) nice to have: anything else that supports it by default

3) Provides REMOTE_USER for SAPI level consumption

4) Works with nginx 0.7.x (latest builds)
a) need to provide the configuration items (if there's any?) that the webserver would define (auth servers to run against maybe?)
b) Config must scale to multiple backend servers (example: ADserver1, ADserver2, etc.)

5) Should be simple to compile on standard platforms
a) required: Ubuntu, RHEL, running 2.6. kernels and GCC
b) nice to have: BSD, other nginx-capable platforms

6) License should match nginx. Plan is for it to be created and given back to the community for usage, updates, etc. You will be credited for work (in name) and the work will be released in full to the public.

nginx is available at: http://nginx.net

nginx coding guide (could be helpful): http://emiller.info/nginx-modules-guide.html

Here are links/resources, that may aid in implementing SPNEGO.

• http://modauthkerb.sourceforge.net/ - probably the best source for C code to work with; mod_auth_kerb seems to be the most up to date
• http://mbechler.eenterphace.org/blog/index.php?/archives/5-php_krb5-beta-Negotiate-auth-with-GSSAPI-for-PHP.html - some C source that could be examined (since the PHP module is written in C)
• http://modgssapache.sourceforge.net/ - some C source to leverage
• http://meta.cesnet.cz/cms/opencms/en/docs/software/devel/negotiate.html
• http://msdn.microsoft.com/en-us/library/ms995329.aspx
• http://msdn.microsoft.com/en-us/library/ms995330.aspx
• http://tools.ietf.org/html/rfc2478 - possibly might have info
• http://osdir.com/ml/encryption.kerberos.general/2003-09/msg00019.html - modgssapache uses APIs from microsoft, tested on linux/solaris, mod_spnego tested on all major platforms
• http://bofriis.dk/spnego/spnego_client.html - java implementation
• http://www.ibm.com/developerworks/websphere/library/techarticles/0809_lansche/0809_lansche.html - websphere implementation
• http://dev.taglab.com/sites/taglab-public/support/spnego.html - another java implementation
• http://www.openldap.org/lists/openldap-devel/200801/msg00070.html - possibly added into openldap
• samba 3.0.7+ might have source (see a reference to libsmb/spnego.c)
• http://www.ioplex.com/ - PHP support for SPNEGO